ONAP profile: improve network and security options

The https://www.powderwireless.net/p/emulab-ops/ONAP-OpenStack profile works, but has a few outstanding issues. The major problems are 1) the default Heat template uses too many floating IPs; and 2) many services (both ONAP and others like k8s) are insecurely exposed on the OpenStack ext-net (our control net). We have discussed changes to remedy both of these problems, and have some initial ideas to fix them.